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In the claims: 

Claim 21 is canceled; 

Claims 1-20 and 22 are original. 

1 . (Original) A method for detecting unauthorized use of a wireless local area network 
having at least one mobile unit that conmiunicates with at least one access point, comprising: 

accumulating first network traffic data at a mobile imit; 

accumulating second network traffic data at an access point; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non-correlated 
traffic data and.signaling an alarm condition when said non-correlated traffic data exceeds a 
threshold portion of said traffic data. 

2. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of transmitted messages for said mobile unit. 

3. (Original) A method as specified in claim 2 wherein said first traffic data includes 
destination address of said transmitted messages. 

4. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of received messages for said mobile unit. 

5. (Original) A method as specified in claim 4 wherein said first traffic data includes 
source address of said received messages. 

6. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of association requests of said mobile unit with said access point. 

7. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of disassociation transactions. 
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8. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of broadcast and multicast frames received by said mobile unit. 

9. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of authentication requests. 

10. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of transmitted messages for said access point. 

11. (Original) A method as specified in claim 10 wherein said second traffic data 
includes destination address of said transmitted messages. 

12. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of received messages for said access point. 

13. (Original) A method as specified in claim 10 wherein said second traffic data 
includes source address of said received messages. 

14. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of association requests of mobile units with said access point. 

15. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of disassociation transactions. 

16. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of broadcast and multicast frames sent by said access point. 

17. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of authentication requests. 

18. (Original) A method as specified in claim 1 wherein said communicating said 
traffic data to a computer is repeated on a periodic basis. 
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19. (Original) A method as specified in claim 1 wherein said communicating said 
traffic data to a computer is in response to a command signal from said computer. 

20. (Original) A method for detecting unauthorized use of a wireless local area 
network having at least two mobile units that corhmunicate with at least one access point, 
comprising: 

accumulating first network traffic data at a first mobile unit; 

accumulating second network traffic data at a second mobile unit; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non-correlated 
traffic data and signaling an alarm condition when said non-correlated traffic data exceeds a 
threshold portion of said traffic data. 

21. (Canceled) 

22. (Original) A system for detecting unauthorized use of a wireless local area 
network, comprising: 

at least one mobile unit; 

at least one access point; and 

at least one server computer, 
wherein first network traffic data is accumulated by said at least one mobile unit, 
second network traffic data is accumulated by said at least one access point, said first and 
second network traffic data are communicated to said at least one server computer, said first 
and second network traffic data are correlated by said at least one server computer to identify 
non-correlated traffic data, and an alarm condition is signaled when said non-correlated traffic 
data exceeds a threshold. 
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